Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect mapping updated in `SystemConfig::updateReferrerInfo`

robertodf99

Summary

A portion of the platform fee charged on each trade can be directed to a referrer, as designated by the user. The referrer must be a different address from the caller to prevent users from claiming the entire referral bonus themselves. However, there is a flaw in the way this referrer address is set: the referrer information is stored in the referrer's mapping instead of the caller's. As a result, every user's referrer becomes themselves, rendering the entire referral system ineffective.

Vulnerability Details

The following code snippet from the updateReferrerInfo function illustrates the issue:

ReferralInfo storage referralInfo = referralInfoMap[_referrer];
referralInfo.referrer = _referrer;
referralInfo.referrerRate = _referrerRate;
referralInfo.authorityRate = _authorityRate;

In this code, the referral information is stored using the _referrer address as the key, instead of the function caller's address. Consequently, the referrer address is incorrectly set to the user's own address, along with the associated rates, which negates the intended functionality of the referral system.

Impact

See PoC below:

function test_referral_bonus() public {
vm.startPrank(user);
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
vm.stopPrank();
​
vm.startPrank(user1);
// user1 wants to set user as the referrer
systemConfig.updateReferrerInfo(user, baseReferralRate, 0);
mockUSDCToken.approve(address(tokenManager), type(uint256).max);
address offerAddr = GenerateAddress.generateOfferAddress(0);
​
preMarktes.createTaker(offerAddr, 500);
vm.stopPrank();
​
assertEq(
tokenManager.userTokenBalanceMap(
user,
address(mockUSDCToken),
TokenBalanceType.ReferralBonus
),
0
); // It should instead be equal to 7500000000000 (0.0000075e18)
}

Tools Used

Manual review.

Recommendations

Store information using _msgSender() key:

-ReferralInfo storage referralInfo = referralInfoMap[_referrer];
+ReferralInfo storage referralInfo = referralInfoMap[_msgSender()];
referralInfo.referrer = _referrer;
referralInfo.referrerRate = _referrerRate;
referralInfo.authorityRate = _authorityRate;
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-SystemConfig-updateReferrerInfo-msgSender

Valid high severity. There are two impacts here due to the wrong setting of the `refferalInfoMap` mapping. 1. Wrong refferal info is always set, so the refferal will always be delegated to the refferer address instead of the caller 2. Anybody can arbitrarily change the referrer and referrer rate of any user, resulting in gaming of the refferal system I prefer #1500 description the most, be cause it seems to be the only issue although without a poc to fully describe all of the possible impacts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.